# While importing php errors log file in logstash not getting fields seperated from message in elastisearch

**URL:** https://discuss.elastic.co/t/while-importing-php-errors-log-file-in-logstash-not-getting-fields-seperated-from-message-in-elastisearch/165017
**Category:** Logstash
**Created:** [January 21, 2019, 9:28am UTC](https://discuss.elastic.co/t/while-importing-php-errors-log-file-in-logstash-not-getting-fields-seperated-from-message-in-elastisearch/165017 "2019-01-21T09:28:48Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Bdr](https://avatars.discourse-cdn.com/v4/letter/b/7c8e57/32.png) [@Bdr](https://discuss.elastic.co/u/Bdr)
#### Post date: [January 21, 2019, 9:28am UTC](https://discuss.elastic.co/t/while-importing-php-errors-log-file-in-logstash-not-getting-fields-seperated-from-message-in-elastisearch/165017/1 "2019-01-21T09:28:48Z")

</div>

This is my php error log file

[20-Sep-2018 00:01:00 America/Los\_Angeles] Uncaught PHP Exception LogicException: "The controller must return a response (null given). Did you forget to add a return statement somewhere in your controller?" at /mnt/www/html/shoppingstore/docroot/vendor/symfony/http-kernel/HttpKernel.php line 171 request\_id="v-ee827c28-bca2-11e8-80cc-22000a1e2cfa"

This is my logstash confg file  
""""""  
input {  
file {  
path =\> "/home/Desktop/logfiles/php-errors.log"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}  
filter {  
grok {  
match =\> { "message" =\> "[%{MONTHDAY:day}-%{MONTH:month}-%{YEAR:year} %{TIME:time} %{WORD:zone}/%{WORD:country}] PHP %{DATA:level}: %{GREEDYDATA:error}" }  
}

}

output {  
elasticsearch {  
hosts =\> "localhost:9200"  
manage\_template =\> false  
index =\> "phperrorlog-%{+YYYY.MM.dd}"  
document\_type =\> "phperrorlog"  
}  
stdout { codec =\> rubydebug }  
}  
""""""

Output Response:  
""  
{

\_index: "phperrorlog-2019.01.21",

\_type: "phperrorlog",

\_id: "yOWzb2gBmOi9Cy9CHuGo",

\_score: 1,

\_source: {  
message: "[20-Sep-2018 00:01:00 America/Los\_Angeles] Uncaught PHP Exception LogicException: "The controller must return a response (null given). Did you forget to add a return statement somewhere in your controller?" at /mnt/www/html/shoppingstore/docroot/vendor/symfony/http-kernel/HttpKernel.php line 171 request\_id="v-ee827c28-bca2-11e8-80cc-22000a1e2cfa"",

@timestamp: "2019-01-21T09:17:15.558Z",

host: "p1",

tags: [  
"\_grokparsefailure"],

@version: "1",

path: "/home/Desktop/logfiles/php-errors.log"}

},  
""""  
I need values in that message separately like DATA, GREEDYDATA, TIME  
Please help someone.

---

<div class="post-metadata">

### Author: ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [January 21, 2019, 12:37pm UTC](https://discuss.elastic.co/t/while-importing-php-errors-log-file-in-logstash-not-getting-fields-seperated-from-message-in-elastisearch/165017/2 "2019-01-21T12:37:20Z")

</div>

This is what you need...

```auto
input {
  generator {
    lines => [
      '[20-Sep-2018 00:01:00 America/Los_Angeles] Uncaught PHP Exception LogicException: "The controller must return a response (null given). Did you forget to add a return statement somewhere in your controller?" at /mnt/www/html/shoppingstore/docroot/vendor/symfony/http-kernel/HttpKernel.php line 171 request_id="v-ee827c28-bca2-11e8-80cc-22000a1e2cfa"'
    ]
    count => 1
  }
}

filter {
  grok {
    pattern_definitions => { "DATESTAMP_PHP" => "%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME} %{WORD}\/%{WORD}" }
    match => {
      "message" => [
        '\[%{DATESTAMP_PHP:timestamp}\] %{GREEDYDATA:msg}'
      ]
    }
    break_on_match => true
  }
}

output {
  stdout {
    codec => rubydebug
  }
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 18, 2019, 12:37pm UTC](https://discuss.elastic.co/t/while-importing-php-errors-log-file-in-logstash-not-getting-fields-seperated-from-message-in-elastisearch/165017/3 "2019-02-18T12:37:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.